Paul Durrant

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.14.x **Description** An issue allows x86 guest OS users to cause a denial of service, data corruption, or a data leak, and possibly gain privileges. This occurs because an AMD IOMMU page-table entry can be half-updated. **Recommendations** For versions through 4.14.x, consider restricting access to the AMD IOMMU to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.13 **Description** An issue in Xen allows attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device. This occurs because passed through PCI devices may corrupt host memory after deassignment. When a PCI device is assigned to an untrusted domain, it is possible for that domain to program the device to DMA to an arbitrary address. The IOMMU is used to protect the host from malicious DMA by making sure that the device addresses can only target memory assigned to the guest. However, when the guest domain is torn down, or the device is deassigned, the device is assigned back to dom0, thus allowing any in-flight DMA to potentially target critical host data. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. **Recommendations** For Xen versions prior to 4.13, consider disabling PCI pass-through to untrusted domains as a temporary workaround until a patch is available. Restrict access to physical devices capable of DMA to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.11.x **Description** The issue is related to the physmap concept of hardware virtualization in the Xen hypervisor, which lacks proper input validation. This allows an attacker to gain unauthorized access to sensitive data, cause a denial of service, or compromise data integrity. The problem can be exploited by x86 PV guest OS users. **Recommendations** For Xen versions through 4.11.x, update to a version that includes the necessary security patches to fix the issue with the physmap concept. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.12 **Description** An issue in Xen on AMD x86 platforms may allow guest OS users to gain host OS privileges due to TLB flushes not always occurring after IOMMU mapping changes. The vulnerability is related to an incorrect TLB flush after IOMMU mapping changes, which can be exploited to elevate privileges. **Recommendations** For Xen versions prior to 4.12, update to version 4.12 or later to resolve the issue. As a temporary workaround, consider implementing additional access controls to minimize the risk of privilege escalation. Restrict access to sensitive resources and limit the privileges of guest OS users to reduce the potential impact of exploitation.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.12 **Description** An issue in Xen on AMD x86 platforms allows guest OS users to potentially gain host OS privileges due to the unsafe combination of small IOMMU mappings into larger ones. This could enable an attacker to elevate their privileges. **Recommendations** For Xen versions prior to 4.12, update to a version that includes the fix for this issue to prevent potential privilege escalation.

Name of the Vulnerable Software and Affected Versions: Xen versions 4.11.x Description: An issue in Xen allows x86 guest OS users to cause a denial of service, resulting in the host OS hanging. This occurs because the p2m lock remains unavailable indefinitely in certain error conditions. The vulnerability is related to incorrect error handling. Recommendations: For Xen version 4.11.x, consider applying configuration changes to mitigate the risk of denial of service, such as adjusting error handling mechanisms to prevent the p2m lock from remaining unavailable indefinitely. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.